Here's prompt injection via a harness for example: https://www.promptarmor.com/resources/google-antigravity-exf...

took me about 30 seconds to find. there's tons of them. of course it's an arms race, the models get better the harnesses get better the attackers get better but again: for the model itself, your prompt and third party data it reads are the same thing (input). as long as it is true, the attack will always be possible.